added authentication and routing for 'add comment'